During its 41st plenary session, the European Data Protection Board has adopted, with a majority of the members ⅔, the first decision aiming at the resolution of a dispute under Article 65 of the GDPR. The decision, which is of a binding nature, seeks to resolve the dispute which has arisen following a draft decision issued by the Irish supervisory authority, as the main supervisory authority, in relation to Twitter International Company and the relevant and reasoned actions (RROs) formulated successively by some of the supervisory authorities concerned. 

The Irish supervisory authority has issued the draft decision following investigations and desk checks conducted in front of the Twitter international company, after the company had notified a personal data breach to the supervisory authority on 8 January 2019.

In May 2020, the Icelandic supervisory authority shared its draft decision with the supervisory authorities concerned under Article 60(3) of the GDPR. The supervisory authorities concerned had 4 weeks to submit their respective relevant and reasoned observations (RRO). RROs have therefore been submitted on, inter alia, the individual GDPR violations from the main supervisory authority, the role of Twitter International Company as sole data controller and the quantification of the financial penalty to be applied.

Having rejected the options and/or having thought that they were not relevant with reasons, the Principal Authority has referred the matter to the Board under Article 60(4) of the GDPR, thus starting the dispute resolution procedure.

After the issuance by the leading authority, the completeness of the fascicle has been assessed and the formal commencement of the ex-Article 65 procedure has taken place on 8 September 2020. In accordance with Article 65(3) of the GDPR and in combination with Article 11(4) of the Board’s Rules of Procedure, the general one-month deadline for the adoption of the decision was extended by one month due to the complexity of the issue.

The Board adopted its binding decision on 9 November 2020 and will shortly formally notify it to the Irish supervisory authority.

The Irish authority will take its final, indirect decision on the basis of the Board’s decision to the controller without undue delay and at the latest within one month of notification of the Board’s decision itself. The Principal Authority and the supervisory authorities concerned inform the Board of the date on which the controller is notified of the final decision. After this notification, the Board will publish its decision on its own website

SOURCE: FEDERPRIVACY